---
title: "Mint the WebAuthn ceremony options"
method: POST
path: "/approvals/a/{approvalId}/options"
tags: ["approvals"]
---

# Mint the WebAuthn ceremony options

`POST /approvals/a/{approvalId}/options`

## Request

- Base URL: `https://api.bubblio.dev`
- URL: `https://api.bubblio.dev/approvals/a/{approvalId}/options`
- Auth: none declared

mode `auth` (returning human: one passkey assertion) or `register` (the first
FaceID: enrollment IS the approval). Both carry the SAME deterministic challenge —
the SHA-256 of this approval's canonical terms — so whichever ceremony runs, the
signature covers exactly what is being approved. A connect ceremony refuses to mint
options until its grant holds the platform-minted key.

## Path parameters

- `approvalId` string, required

## Request body

- object
  - `mode` 'auth' | 'register', required

## Response `200`

WebAuthn creation/request options for the browser ceremony.

- object

## Other responses

- `400`: One calm sentence naming the malformed field.
- `404`: UNIFORM: unknown, malformed, foreign, and lagged approvals all read the same.
- `409`: Already decided/expired, or the connect gate is not yet connected (`code: not_connected`).
- `429`: Per-IP ceiling tripped.

---

[API](https://skmtc.dev/bubblio/apis/bubblio-agent-door-api.md) · [All operations](https://skmtc.dev/bubblio/apis/bubblio-agent-door-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bubblio/apis/bubblio-agent-door-api/revisions/d858aff9c01d?raw)